Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions dev-server.js
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,14 @@ import browserify from 'browserify-middleware'
import cssjanus from 'cssjanus'
import { assembleCss } from './scripts/assemble-css'

const rpath = p => pathu.join(__dirname, p)
const rpath = p => {
const safe = pathu.normalize(p).replace(/^(\.\.(\/|\\|$))+/, '')
const resolved = pathu.join(__dirname, safe)
if (!resolved.startsWith(__dirname + pathu.sep) && resolved !== __dirname) {
throw new Error('Invalid path')
}
return resolved
}

const app = express()
const router = express.Router()
Expand Down Expand Up @@ -85,6 +92,6 @@ router.use((req, res) => res.render(rpath('client/index.pug')))

app.use(basePath, router)

app.listen(process.env.PORT || 5000, function(){
app.listen(process.env.PORT || 5000, process.env.HOST || '127.0.0.1', function(){
console.log(`HTTP server running on ${this.address().address}:${this.address().port}`)
})